In tar_extract of tarfmt.c and the extraction routine of zipfmt.c, archive entry names are used to construct destination file paths without sanitizing '.' or '..' path components or absolute paths. This allows a specially crafted tar or zip archive to write, overwrite, or delete arbitrary files outside the intended extraction directory when extracted via the 'tar x' or 'unzip' shell commands. User interaction is required only to the extent of extracting an attacker-supplied archive.
CWE-22, CWE-73
Artfical DT Developer Talha Berk Arslan